Title: [282503] releases/WebKitGTK/webkit-2.32/Source/WebCore
- Revision
- 282503
- Author
- [email protected]
- Date
- 2021-09-16 01:14:44 -0700 (Thu, 16 Sep 2021)
Log Message
Merge r275972 - Crash in ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds()
https://bugs.webkit.org/show_bug.cgi?id=224520
Patch by Julian Gonzalez <[email protected]> on 2021-04-14
Reviewed by Ryosuke Niwa.
Adopt RefPtr<Node> instead of using plain Node* here to avoid a crash.
* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog (282502 => 282503)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 08:12:36 UTC (rev 282502)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/ChangeLog 2021-09-16 08:14:44 UTC (rev 282503)
@@ -1,3 +1,15 @@
+2021-04-14 Julian Gonzalez <[email protected]>
+
+ Crash in ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds()
+ https://bugs.webkit.org/show_bug.cgi?id=224520
+
+ Reviewed by Ryosuke Niwa.
+
+ Adopt RefPtr<Node> instead of using plain Node* here to avoid a crash.
+
+ * editing/ReplaceSelectionCommand.cpp:
+ (WebCore::ReplaceSelectionCommand::removeUnrenderedTextNodesAtEnds):
+
2021-04-14 Carlos Garcia Campos <[email protected]>
Do not reset computed style for element children with display contents style
Modified: releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp (282502 => 282503)
--- releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-09-16 08:12:36 UTC (rev 282502)
+++ releases/WebKitGTK/webkit-2.32/Source/WebCore/editing/ReplaceSelectionCommand.cpp 2021-09-16 08:14:44 UTC (rev 282503)
@@ -828,11 +828,11 @@
{
document().updateLayoutIgnorePendingStylesheets();
- Node* lastLeafInserted = insertedNodes.lastLeafInserted();
+ auto lastLeafInserted = makeRefPtr(insertedNodes.lastLeafInserted());
if (is<Text>(lastLeafInserted) && !hasRenderedText(downcast<Text>(*lastLeafInserted))
- && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted), selectTag)
- && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted), scriptTag)) {
- insertedNodes.willRemoveNode(lastLeafInserted);
+ && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted.get()), selectTag)
+ && !enclosingElementWithTag(firstPositionInOrBeforeNode(lastLeafInserted.get()), scriptTag)) {
+ insertedNodes.willRemoveNode(lastLeafInserted.get());
removeNode(*lastLeafInserted);
}
@@ -840,9 +840,9 @@
// We don't have to make sure that firstNodeInserted isn't inside a select or script element
// because it is a top level node in the fragment and the user can't insert into those elements.
- Node* firstNodeInserted = insertedNodes.firstNodeInserted();
+ auto firstNodeInserted = makeRefPtr(insertedNodes.firstNodeInserted());
if (is<Text>(firstNodeInserted) && !hasRenderedText(downcast<Text>(*firstNodeInserted))) {
- insertedNodes.willRemoveNode(firstNodeInserted);
+ insertedNodes.willRemoveNode(firstNodeInserted.get());
removeNode(*firstNodeInserted);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
